From bf45dcf139f6117b4bf3fb18f73a49cac29945d3 Mon Sep 17 00:00:00 2001
From: Hariom Balhara <hariombalhara@gmail.com>
Date: Thu, 3 Aug 2023 21:02:38 +0530
Subject: [PATCH] fix: More instances of wrong avatar URL fixed (#10519)

* Fix user.avatar

* Fix avtars in admin users listing

* Handle unpublished org
---
 apps/web/pages/api/user/avatar.ts             | 31 ++++++++++++-------
 .../ee/organizations/lib/orgDomains.ts        |  4 ++-
 .../ee/users/components/UsersTable.tsx        |  2 +-
 .../server/middlewares/sessionMiddleware.ts   |  4 ++-
 .../viewer/admin/listPaginated.handler.ts     |  1 +
 5 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/apps/web/pages/api/user/avatar.ts b/apps/web/pages/api/user/avatar.ts
index 4059f87900..2535ddfc6b 100644
--- a/apps/web/pages/api/user/avatar.ts
+++ b/apps/web/pages/api/user/avatar.ts
@@ -2,7 +2,7 @@ import crypto from "crypto";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { z } from "zod";
 
-import { orgDomainConfig } from "@calcom/features/ee/organizations/lib/orgDomains";
+import { getSlugOrRequestedSlug, orgDomainConfig } from "@calcom/features/ee/organizations/lib/orgDomains";
 import { getPlaceholderAvatar } from "@calcom/lib/defaultAvatarImage";
 import prisma from "@calcom/prisma";
 
@@ -12,22 +12,33 @@ const querySchema = z
   .object({
     username: z.string(),
     teamname: z.string(),
+    /**
+     * Allow fetching avatar of a particular organization
+     * Avatars being public, we need not worry about others accessing it.
+     */
+    orgId: z.string().transform((s) => Number(s)),
   })
   .partial();
 
 async function getIdentityData(req: NextApiRequest) {
-  const { username, teamname } = querySchema.parse(req.query);
+  const { username, teamname, orgId } = querySchema.parse(req.query);
   const { currentOrgDomain, isValidOrgDomain } = orgDomainConfig(req.headers.host ?? "");
+
   const org = isValidOrgDomain ? currentOrgDomain : null;
+
+  const orgQuery = orgId
+    ? {
+        id: orgId,
+      }
+    : org
+    ? getSlugOrRequestedSlug(org)
+    : null;
+
   if (username) {
     const user = await prisma.user.findFirst({
       where: {
         username,
-        organization: isValidOrgDomain
-          ? {
-              slug: currentOrgDomain,
-            }
-          : null,
+        organization: orgQuery,
       },
       select: { avatar: true, email: true },
     });
@@ -42,11 +53,7 @@ async function getIdentityData(req: NextApiRequest) {
     const team = await prisma.team.findFirst({
       where: {
         slug: teamname,
-        parent: isValidOrgDomain
-          ? {
-              slug: currentOrgDomain,
-            }
-          : null,
+        parent: orgQuery,
       },
       select: { logo: true },
     });
diff --git a/packages/features/ee/organizations/lib/orgDomains.ts b/packages/features/ee/organizations/lib/orgDomains.ts
index e82ef8d83f..93fa3b5232 100644
--- a/packages/features/ee/organizations/lib/orgDomains.ts
+++ b/packages/features/ee/organizations/lib/orgDomains.ts
@@ -1,5 +1,7 @@
 import { ALLOWED_HOSTNAMES, RESERVED_SUBDOMAINS, WEBAPP_URL } from "@calcom/lib/constants";
 
+import type { Prisma } from ".prisma/client";
+
 /**
  * return the org slug
  * @param hostname
@@ -60,5 +62,5 @@ export function getSlugOrRequestedSlug(slug: string) {
         },
       },
     ],
-  };
+  } satisfies Prisma.TeamWhereInput;
 }
diff --git a/packages/features/ee/users/components/UsersTable.tsx b/packages/features/ee/users/components/UsersTable.tsx
index 1f46b63459..0063fbe283 100644
--- a/packages/features/ee/users/components/UsersTable.tsx
+++ b/packages/features/ee/users/components/UsersTable.tsx
@@ -135,7 +135,7 @@ function UsersTableBare() {
                       size="md"
                       alt={`Avatar of ${user.username || "Nameless"}`}
                       gravatarFallbackMd5=""
-                      imageSrc={`${WEBAPP_URL}/${user.username}/avatar.png`}
+                      imageSrc={`${WEBAPP_URL}/${user.username}/avatar.png?orgId=${user.organizationId}`}
                     />
 
                     <div className="text-subtle ml-4 font-medium">
diff --git a/packages/trpc/server/middlewares/sessionMiddleware.ts b/packages/trpc/server/middlewares/sessionMiddleware.ts
index f484d8189c..e40a717c85 100644
--- a/packages/trpc/server/middlewares/sessionMiddleware.ts
+++ b/packages/trpc/server/middlewares/sessionMiddleware.ts
@@ -104,7 +104,9 @@ export async function getUserFromSession(ctx: TRPCContextInner, session: Maybe<S
   const orgMetadata = teamMetadataSchema.parse(user.organization?.metadata || {});
   const rawAvatar = user.avatar;
   // This helps to prevent reaching the 4MB payload limit by avoiding base64 and instead passing the avatar url
-  user.avatar = rawAvatar ? `${WEBAPP_URL}/${user.username}/avatar.png` : defaultAvatarSrc({ email });
+  user.avatar = rawAvatar
+    ? `${WEBAPP_URL}/${user.username}/avatar.png?orgId=${user.organizationId}`
+    : defaultAvatarSrc({ email });
   const locale = user?.locale || ctx.locale;
 
   const isOrgAdmin = !!user.organization?.members.length;
diff --git a/packages/trpc/server/routers/viewer/admin/listPaginated.handler.ts b/packages/trpc/server/routers/viewer/admin/listPaginated.handler.ts
index d88de5608a..6f2f9de6ed 100644
--- a/packages/trpc/server/routers/viewer/admin/listPaginated.handler.ts
+++ b/packages/trpc/server/routers/viewer/admin/listPaginated.handler.ts
@@ -49,6 +49,7 @@ export const listPaginatedHandler = async ({ ctx, input }: GetOptions) => {
       name: true,
       timeZone: true,
       role: true,
+      organizationId: true,
     },
   });